diff --git a/hiboo/application/sso.py b/hiboo/application/sso.py index 9f7feebbf9135ac902f3b4de95060a25fe05ac2d..bc10bb8dc18769ca92ef08b62a660e494e2ce5e0 100644 --- a/hiboo/application/sso.py +++ b/hiboo/application/sso.py @@ -36,7 +36,8 @@ class GenericOIDCApplication(base.OIDCApplication): special_mappings = fields.SelectMultipleField( _('Enabled special claim mappings'), choices=[ ("mask_sub_uuid", _("Mask the profile uuid")), - ("original_email", _("Return the actual user email")) + ("original_email", _("Return the actual user email")), + ("ignore_scopes", _("Return all claims independently of asked scopes")) ] ) submit = fields.SubmitField(_('Submit')) diff --git a/hiboo/sso/oidc.py b/hiboo/sso/oidc.py index f075f302bea990e78a2333b02084138194c21660..89f69ab0fa746713e835c73a3554175632424fae 100644 --- a/hiboo/sso/oidc.py +++ b/hiboo/sso/oidc.py @@ -125,14 +125,16 @@ class Client(sqla_oauth2.OAuth2ClientMixin): """ special_mappings = self.service.config.get("special_mappings", []) claims = dict() - if "profile" in scope: + if "profile" in scope or "ignore_scopes" in special_mappings: claims.update( sub=profile.username if "mask_sub_uuid" in special_mappings else profile.uuid, name=profile.username, preferred_username=profile.username, - login=profile.username + login=profile.username, + user_id=None if "mask_sub_uuid" in special_mappings else profile.uuid, + username=profile.username ) - if "email" in scope: + if "email" in scope or "ignore_scopes" in special_mappings: user_email = profile.user.contact.get("email") if profile.user.contact else None claims.update( email=user_email if "original_email" in special_mappings else profile.email